Microsoft’s November Patch Tuesday fixed more than 1,000 flaws and an exploited Outlook zero-day, CVE-2026-124194, that leaks NTLMv2 hashes to
SAP’s November Patch Day fixed 35 flaws, four rated CVSS 10.0, including unauthenticated RCE in ICM and Web Dispatcher dubbed
Attackers are exploiting a critical Xen Orchestra authentication bypass, VSA-2026-062, to gain admin control and possibly root on XCP-ng virtualization
Barracuda confirms attackers are chaining CVE-2026-116606 and CVE-2026-111560 to gain root on its security appliances, and CISA added both to
Git 2.56.1 patches six vulnerabilities, including CVE-2026-111760, which can run attacker code when developers recursively clone a malicious repository.
An attacker used a remote code execution flaw in the SGLang inference engine to breach NEAR AI, exposing 18 AI
A public iOS exploit named worse_query could expose crypto seed phrases and private keys from other apps; Binance warned users
Apple’s iOS 27.2.1 patches iMessage group chat flaws CVE-2026-113961 and CVE-2026-113960 plus nine Bluetooth and AirPlay pairing bugs; no exploitation
Fortinet fixed eight critical vulnerabilities rated CVSS 9.0 to 9.8 across FortiOS, FortiManager, FortiAnalyzer and FortiSASE; six need no authentication.
Synology fixed 27 DiskStation Manager flaws, including CVE-2026-76954, a pre-authentication SQL injection in the Auth API rated CVSS 9.8, with
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.